lxbaserat | 1f69b3ae0ef84bd1b51e49d3abd2d63e9b4339a62acf43bd6b874aebd398a104

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
H2mzrg74S9G1HknTq9LWPptDOaYqz0O9a4dK69OYoQQ.js
Size 654KB
Sample261026-wfac5abf37
SHA256 1f69b3ae0ef84bd1b51e49d3abd2d63e9b4339a62acf43bd6b874aebd398a104
MD5 cf6a7b11f97cb5d9411ee0d35858e7f2
SHA1 ed8acc797f17828c5b58159dff17e23311a994e5
SHA512 54c8ad5c22201c3136e9a569f9b2ca2567b2d295c28db4e33dd4deea2102ee7223e550be106e0a405df165b7b57eb504b0a4e3b8f64e2918b5d8ef47b430f47f
SSDEEP 12288:0y6Uv6IA/iKgLvYE2WAZTijN99RODvyRW1ivOfMYtFmQD/RGFRqwWj8T:0lVcwvWA1gL2fhGCqqwhT
TLSH
T1E6E422903B8A583F837CD518649B3B0DAB190BF01988B5DF403DA1E61B76BA197DBC5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

general 1aac089f0eec48da9cd636019342394f discovery execution lxbaserat persistence rat

Malware Config

Extracted

Family

lxbaserat

Version

1.0.51

Botnet

General

Campaign

1aac089f0eec48da9cd636019342394f

general.activeworkshops.com:4521

Attributes

directory
WindowsTelemetry\Logs
executable
client.exe
password
JxC41yjMt9nWZNpYLUNB

Signatures

Family: LxBaseRAT
LxBaseRAT is a .NET remote access trojan with stealer capabilities.
rat lxbaserat

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3068	3412	powershell.exe	91

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3068	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 2736	3068	powershell.exe	105

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3068	powershell.exe
3068	powershell.exe
2736	CasPol.exe
2736	CasPol.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	2736	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2736	CasPol.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 3972	3068	powershell.exe	101
PID 3972 wrote to memory of 4000	3972	csc.exe	102
PID 3068 wrote to memory of 2736	3068	powershell.exe	105
PID 3068 wrote to memory of 2736	3068	powershell.exe	105
PID 3068 wrote to memory of 2736	3068	powershell.exe	105
PID 3068 wrote to memory of 2736	3068	powershell.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\H2mzrg74S9G1HknTq9LWPptDOaYqz0O9a4dK69OYoQQ.js
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:6072

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command "[scriptblock]::Create([IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\pmzptymmzc\w33274.ps1')).Invoke()"
1⤵
- Process spawned unexpected child process
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pjiwj14a\pjiwj14a.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE8A.tmp" "c:\Users\Admin\AppData\Local\Temp\pjiwj14a\CSC9C17E764232C4C9F8F4273C7E688436.TMP"
    3⤵
    PID:4000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2736

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESFE8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFE8A.tmp
Size 1KB
SHA256 f4cddfa0afd9aa3316a85b46ea6d2ae2163f7399f339e2d005e05a6866d42d21
MD5 f151d83b7ba506ba5bed0b2d5a52d31e
SHA1 3fad0eafd28ef23f7826b75333376359f0a47b15
SHA512 656ed1a1b400052dcccde784005078f3f04c12ea88afcabe26a7c30e3f720c494df55cb181a7657c2b045917fdaf7889cff5ca9e8961db9849d66a7bc83d0919
TLSH
T1BF21AB0553E8071FF0B75B31ADF6176FA238FD68EF62536B808002282C40604EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tcf5kw2z.gx1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcf5kw2z.gx1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

pjiwj14a.dll

Path C:\Users\Admin\AppData\Local\Temp\pjiwj14a\pjiwj14a.dll
Size 3KB
SHA256 8b29540f8e9849b0ac6e03ea87167e46cc8aa014dbf35e76a72ef6c25b4da625
MD5 44f92baa9ee93fcfa516f45eee9c58c5
SHA1 eba137a6ed649f93a4261daaf50e2367430715d9
SHA512 81c205f43b552db82135494607368c94b11778a2be8814889f74eff66355259c34d26efb94bbf85e60142c1e83ad312ef5e79c74f5cf3b30c6845c0860ab3260
TLSH
T18951FB16A7E84A27E4B747346EF3032633B8F8609B73536E59D00229ACA42245E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

w33274.ps1

Path C:\Users\Admin\AppData\Local\Temp\pmzptymmzc\w33274.ps1
Size 928KB
SHA256 65b53a85f71a688a92596f58f9c07446c66a1f62f1698f02653dd7324e07b94a
MD5 4b9c4574e8b598a6d1b83c6e6ad5db76
SHA1 4e89c1a23a93822d89e74c0221b7de654ab0f68d
SHA512 fc0a8aa5b832d6f0e980053f637849011921f6768e98dd56e72bdc7a9a092c523ce6f6acebc01556780f05f5fead381045e1cd1f93f16d55295d4e859807d168
SSDEEP 12288:RlhX6GFtKgRXp1gqsCwtSjysyIzXDVcPanIffXeMSLURdI13zORRCjAiFfCGw+nQ:9Q9JQXJIrILgGJK0TGVUm
TLSH
T12B1539343AFA5019B173EF5A9BE874A7DA6FBB73370A985D1091034A0723941DDC1A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC9C17E764232C4C9F8F4273C7E688436.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pjiwj14a\CSC9C17E764232C4C9F8F4273C7E688436.TMP
Size 652B
SHA256 f2d916d490a8f34226a704048fc12ea244226f7e09c4f5e6265bd13ebb7732f9
MD5 5b2e4836e82774bdae1beee244fd7362
SHA1 25dd32a5d1d92cf5236373df5731fdc479eb5740
SHA512 ec58ab05aa0c7bfc67e3435322c80b00bc8c556d47ea0d05094f78c759931b709ca2f43cda11a5dd4e12362e7a5e11771d3964a3c21e7f3e692d310b64c20908
TLSH
T1CCF05E4973F8020EF0F78B70BDF643A791A9BC64DE3293ED249003196C649209962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

pjiwj14a.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pjiwj14a\pjiwj14a.0.cs
Size 421B
SHA256 6b2c52f180056c93aabd5999b142ba5ae8f3c713b973b9e77be6b8fa1df70a74
MD5 91a07b11b8cef64c37389ba57d3b3b53
SHA1 083bc769715520e6c553a36b69d445240ba35ed8
SHA512 0a1c2660fd402b15ca5fa49dcb92c9407cb2cacceaf07ef34b4d0411dfbf33ec5fde9cd301739c477e25b4336b918fcb535317d7e56da341fc9f6d02ce590eda
TLSH
T151E09B25769297B1083245269D42D0EDF6170022267B2A10F6B517336F6B205E73C91D
MD5 SHA1 SHA512 TLSH

Submit Download

pjiwj14a.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pjiwj14a\pjiwj14a.cmdline
Size 369B
SHA256 52a3bbed4b2fbd8e6ab299e3ae48347b4afcc2b22f9b8866a9a987a6852b7c72
MD5 70ccfef6ebdedf8a9b96e1e1425b708f
SHA1 92cb2aab090baee21c4a67989cbf6665b1f0c59c
SHA512 a04eb253620c27405cf350b304fc506122b0d7084228485857958884a51a14f74fce4c11d476cd3bed3ddc54dc05b86cc737665029d2b413dd5878423044a4df
TLSH
T127E0C02A42C7C37E21DD10072B69C8FCD272074B29807FFC5040441EE01751C2BD17D9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2736-30-0x0000000000400000-0x000000000049E000-memory.dmp

Download

memory/3068-11-0x000001B30AF60000-0x000001B30AF70000-memory.dmp

Download

memory/3068-1-0x000001B30AF60000-0x000001B30AF70000-memory.dmp

Download

memory/3068-24-0x000001B30B090000-0x000001B30B098000-memory.dmp

Download

memory/3068-26-0x000001B326C60000-0x000001B326C7A000-memory.dmp

Download

memory/3068-27-0x000001B30AF60000-0x000001B30AF70000-memory.dmp

Download

memory/3068-28-0x000001B30AF60000-0x000001B30AF70000-memory.dmp

Download

memory/3068-29-0x000001B30B0A0000-0x000001B30B0A8000-memory.dmp

Download

memory/3068-7-0x000001B30AFE0000-0x000001B30B002000-memory.dmp

Download